Skip to content
OpenAdvisories
Medium WID-SEC-2026-4322 7 CVEs

TYPO3 Extension (Mail): Mehrere Schwachstellen

Published Nov 3, 2026 · Updated Nov 3, 2026 · de-DE

Vendor: TYPO3 Product: Extension Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in der TYPO3 Mail Extension ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um falsche Informationen darzustellen, um Daten zu manipulieren, um Informationen offenzulegen und um einen Cross-Site Scripting Angriff durchzuführen.

Product

TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 7

  • High 8.8
    CVE-2026-120333

    Broken Access Control in extension "Frontend User Registration" (sf_register)

    The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can ther…

    TYPO3 Extension "Frontend User Registration"
  • High 7.1
    CVE-2026-120330

    Broken Access Control in extension "Mail" (mail)

    Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups…

    TYPO3 Extension "Mail"
  • Medium 6.9
    CVE-2026-120328

    Information Disclosure in extension "Mail" (mail)

    The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.

    TYPO3 Extension "Mail"
  • Medium 5.3
    CVE-2026-120327

    Open Redirection in extension "Mail" (mail)

    The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites.

    TYPO3 Extension "Mail"
  • Medium 5.3
    CVE-2026-120329

    Broken Access Control in extension "Mail" (mail)

    Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.

    TYPO3 Extension "Mail"
  • Medium 5.3
    CVE-2026-120331

    Server-Side Request Forgery in extension "Mail" (mail)

    Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.

    TYPO3 Extension "Mail"
  • Medium 5.1
    CVE-2026-120332

    Cross-Site Scripting in extension "Mail" (mail)

    The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or…

    TYPO3 Extension "Mail"

Revision history

  1. #1

    Initiale Fassung

References